CVE-2007-4874
SimpNews 2.41.03 - Cross-Site Scripting via l_username and backurl Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2007-4874. PoCs published by Jesper Jurcenoks.
AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in SimpNews by injecting malicious JavaScript into the 'l_username' parameter. The payload triggers an alert displaying the user's cookies, proving arbitrary script execution in the context of the affected site.
Description
Multiple cross-site scripting (XSS) vulnerabilities in SimpNews 2.41.03 allow remote attackers to inject arbitrary web script or HTML via the (1) l_username parameter to admin/layout2b.php, and the (2) backurl parameter to comment.php.
Exploits (2)
This exploit demonstrates a cross-site scripting (XSS) vulnerability in SimpNews by injecting malicious JavaScript into the 'l_username' parameter. The payload triggers an alert displaying the user's cookies, proving arbitrary script execution in the context of the affected site.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in SimpNews 2.41.03 by injecting a malicious script via the 'backurl' parameter in the comment.php file. The script executes arbitrary JavaScript in the context of the affected site, potentially stealing cookies or performing other malicious actions.